You’re way ahead of the game, right? After all, your company has established policies and procedures mandating how to handle internal and third-party confidential data. You’ve kept track of all regulatory changes and updated your policies accordingly. You require encryption, strong passwords, and the use of firewalls. You conduct regular training sessions with your employees and using the latest front-page stories of data breaches and their resultant business interruptions, lawsuits, fines, and reputational damage you have sufficiently terrified your employees into compliance. But have you thought of everything? Not if your risk management plan doesn’t include vendor-supplied software and applications.
It probably would be difficult for many businesses to even count the number of vendors from whom they have purchased software, but the number is usually in the hundreds. For very large enterprises, the number can be in excess of 20,000. Software is used for everything from payroll, accounting, email, human resources, records, and document management. Approximately 65 percent of enterprise applications are sourced externally and 70 percent of applications developed in-house contain components licensed from vendors. Unfortunately, as noted in PwC’s 2012 Security Report, up to 80 percent of vendor-supplied software and applications fail basic tests for security compliance. And the most commonly identified security vulnerabilities are among the most dangerous. Veracode Inc.’s November 2012 State of Software Security Report notes that four of the top five flaw categories detected in third-party web applications are on the “Open Web Application Security Project (OWASP) Top 10″ list of most dangerous flaws, and that SQL injection, the vulnerability exploited in many of the most prominent data breaches such as LinkedIn and Yahoo, was found in 40 percent of those applications. So businesses that use and/or incorporate vendor-supplied software are definitely taking the bad with the good. All businesses need to understand that every outsourced application represents a data breach risk because of the potential for serious security flaws.
